You are storing sensitive information in a Cloud Storage bucket. For legal reasons, you need to be able to record all requests that read any of the stored data. You want to make sure you comply with…

Question

Options

• AScan the bucket using the Data Loss Prevention API.
• BEnable Data Access audit logs for the Cloud Storage API.
• CEnable the Identity Aware Proxy API on the project.
• DAllow only a single Service Account access to read the data.

• A
  13% (4)
• B
  80% (24)
• C
  3% (1)
• D
  3% (1)

Explanation

Enabling Data Access audit logs for the Cloud Storage API is the correct solution. Google Cloud's Data Access audit logs record API calls that read or modify data - including GetObject and similar read operations. These logs are written to Cloud Logging and can be exported for compliance and legal audit purposes. Option A (DLP API) scans data content but does not log access requests. Option C (Identity Aware Proxy) controls identity-based access but does not produce access logs. Option D (restricting to one Service Account) limits access but provides no audit trail of who read what or when.

No community discussion yet for this question.